CSAILPrivate

Connecting to CSAILPrivate

CSAILPrivate is CSAIL’s encrypted, authenticated wireless network. Use of CSAILPrivate is required to get a static IP address or to print to CSAIL printers when connected to a wireless network. As a reminder, although your traffic over the wireless network will be encrypted, there are still other points within the CSAIL network and outside CSAIL where your traffic can be monitored, albeit with a slightly higher degree of difficulty. The instructions below describe how to set up access using a CSAIL Kerberos username and password. If you are uncomfortable with using your regular CSAIL Kerberos password, or if the device you wish to connect will be shared by multiple people, please visit the helpdesk: they can create a separate Kerberos principal specifically for that purpose.

Android

Android versions going back at least to 4.1 have supported the necessary authentication protocols. These instructions were tested with Android 9 on an unlocked Samsung Galaxy S9+:

Apple iOS

The CSAILPrivate Mac OS / iOS profile stores your Kerberos password in Keychain. Therefore, if you change your CSAIL Kerberos password, you will temporarily not be able to connect to CSAILPrivate. If Mac OS / iOS does not prompt your for your new password when connecting to CSAILPrivate, you will need to remove / re-add the profile with the new password.

MacOS

Supported on 10.10+

The CSAILPrivate Mac OS / iOS profile stores your Kerberos password in Keychain. Therefore, if you change your CSAIL Kerberos password, you will temporarily not be able to connect to CSAILPrivate. If Mac OS / iOS does not prompt your for your new password when connecting to CSAILPrivate, you will need to remove / re-add the profile with the new password.

Ubuntu

Tested on 14.04 and 16.04. You might need to repeat this setup a couple times before it succeeds.

Windows 7

Windows 7 does not include native support for this kind of wireless authentication, but support is bundled with some wireless drivers. This is tested with Intel drivers. Broadcom drivers are believed to work as well, but may have a different configuration dialog. For other Windows 7 systems, you might consider upgrading to Windows 10.

Windows 8 and 10

Generic (any other operating system or wireless device)

The CSAILPrivate wireless uses the following security settings:

Using static IP addresses on the CSAILPrivate network

Devices connected to the CSAILPrivate network can have static IP addresses, but those IP addresses must be in the “CSAIL private wireless” address range (128.30.8.0/22). In order to get a static IP address, you must register a domain name for your device in WebDNS (documentation), and then register the IP address WebDNS gives you in DHCP. Then you can configure your device as described above. ( CSAIL Login required)

Note that CSAILPrivate uses a different network address range than the old StataCenter wireless network (which just used the “Wireless” range). If you have a device that used to have a static IP address via unauthenticated wireless and you’re switching it to the CSAILPrivate network, you’ll need to delete the old entries for it in WebDNS and dhreg, re-register your device getting a new IP address in the “CSAIL private wireless” range, wait about an hour for the changes to take effect (and perhaps a while longer for them to propagate elsewhere if you’re going to be trying to connect to the device by domain name from outside CSAIL), and then follow the steps above to configure your device.

If you have no preference for domain name, we suggest using something like yourlogin-devicetype.csail.mit.edu or yourlogin-model.csail.mit.edu. For instance, I (Jay Sekora) might choose names like

jsekora-phone.csail.mit.edu
jsekora-laptop.csail.mit.edu
jsekora-nexus7.csail.mit.edu
jsekora-thinkpad.csail.mit.edu
jsekora-coffeemaker.csail.mit.edu

(No, I don’t have a network-addressible coffeemaker, more’s the pity.) This is optional, but might help us figure out what’s going on or who to contact in case of problems.